Comment on Microsoft’s June 2023 Patch Tuesday: Satnam Narang, Sr. Staff Research Engineer, Tenable

“This month’s Patch Tuesday includes fixes for 70 CVEs (we’ve omitted the AutoDesk and critical, 62 rated important, one rated moderate and one rated low. This month marks the GitHub CVEs from our count). Of the 70 CVEs patched this month, there are six rated first time that there were no zero-days patched – either publicly disclosed or exploited in the wild.

“Two remote code execution vulnerabilities were patched this month in Microsoft Exchange Server, which has been a ripe target for attackers over the last few years. Both flaws are rated as important but are considered more likely to be exploited compared to some of the other vulnerabilities patched this month. Unlike past Microsoft Exchange Server flaws that were rated higher and did not require authentication, these vulnerabilities require an attacker to be authenticated. That said, attackers can still potentially exploit these flaws if they’re able to obtain valid credentials, which is not as difficult as you’d expect.” — Satnam Narang, sr. staff research engineer at Tenable